Executive brief
Snipe-IT is an asset and inventory management system used by organizations to track IT equipment and resources. In versions before 8.7.0, the backup restore feature permanently deletes the database before checking whether the uploaded backup file is valid. If a superuser accidentally uploads a corrupted backup or clicks restore on the wrong file, all historical data is destroyed with no way to recover it.
Technical details
The vulnerability is an improper ordering of operations in the SettingsController::postRestore() endpoint. The code calls Artisan::call('db:wipe') before validating the uploaded ZIP archive or creating a pre-restore safety backup. The vulnerable component is the restore endpoint (CWE-754: Improper Check for Unusual or Exceptional Conditions, CWE-460: Improper Cleanup on Thrown Exception). Attack vector is network, requires high privileges (superuser only) and user interaction (file upload and restore action). When an invalid ZIP is uploaded, the snipeit:restore command fails silently (returns exit code 0 despite error conditions), but the database is already destroyed. The system then runs database migrations on the empty schema and reports success, leaving no recovery path. Fixed in version 8.7.0 by adding validation gates (ZIP extension check, ZipArchive::open() validation, pre-restore backup creation) before any database modifications.
Affected products
- Snipe-IT Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fixed in version 8.7.0